If your HubSpot account contains personal data about individuals, HubSpot's separate Data Processing Agreement automatically applies and sets the rules for how that data is handled.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The DPA governs GDPR and CCPA compliance for personal data processed through HubSpot, and its terms and obligations are legally binding even though they are in a separate document that many customers may not have read.
Interpretive note: The adequacy of passive DPA incorporation by reference versus affirmative execution for GDPR Article 28 compliance is subject to regulatory interpretation and may vary by EU member state supervisory authority.
The updated terms now explicitly state that AI is embedded throughout HubSpot's platform and is foundational to how subscription services operate. The agreement permits HubSpot to use customer data to train AI models, subject to contractual obligations. You can opt out of having your data used to train AI models by updating your settings in your HubSpot account.
View change record →The removal of this explicit DPA incorporation provision eliminates transparent cross-reference to data processing terms, potentially consolidating data protection obligations into the main agreement or leaving DPA applicability implicit.
View full change record →Any customer whose HubSpot account contains contact records, email addresses, or other personal information about individuals is automatically subject to the DPA, which carries its own compliance obligations around data subject rights, breach notification, and international data transfers.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"HubSpot's Data Processing Agreement ('DPA'), which is incorporated herein by reference, applies to the extent Customer Data includes Personal Data, as defined in the DPA. The DPA sets out the terms that apply to HubSpot's processing of Customer Data and is available at https://legal.hubspot.com/dpa.Excerpt from HubSpot's Terms of Service
REGULATORY LANDSCAPE: This provision directly engages GDPR Article 28, which requires a written contract between data controller and data processor covering specified mandatory terms including processing instructions, confidentiality, security measures, sub-processor obligations, data subject rights …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The DPA governs GDPR and CCPA compliance for personal data processed through HubSpot, and its terms and obligations are legally binding even though they are in a separate document that many customers may not have read.
Any customer whose HubSpot account contains contact records, email addresses, or other personal information about individuals is automatically subject to the DPA, which carries its own compliance obligations around data subject rights, breach notification, and international data transfers.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.